Tencent HunyuanVideo CVE-2025-13710

Exploitation requires the victim to load an attacker-supplied VAE/model checkpoint through the HunyuanVideo load_vae function (e.g., visiting a malicious page that triggers a load, or opening a malicious model file). The specific prerequisite is that load_vae deserializes untrusted data (CWE-502) without validation - on unpatched versions using a torch.load path prior to torch 2.6.0's weights_only=True default. Limiting factors: mandatory user interaction (UI:R) and a local attack vector (AV:L) - there is no direct network trigger; the attacker must get the target to load the crafted file. The root-context impact implies the software is commonly run as root (e.g., in default containers), which amplifies severity where that deployment pattern holds.

Signals are mostly consistent and point to a serious but non-urgent issue. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must open or load a malicious file. This is not a remotely triggerable network RCE despite the advisory title using 'Remote Code Execution'; the 'remote attacker' framing refers to delivering a malicious model/VAE file, not direct network exploitation (AV:L). EPSS is low at 0.51% (42nd percentile), which is coherent with the local, UI-dependent nature and the lack of a listed public exploit. This is NOT in CISA KEV and no POC is referenced in the provided data, so there is no evidence of active exploitation - treat the 'RCE as root' impact as the main driver of severity, not imminent mass exploitation. Net: a genuine high-impact code-execution bug (deserialization/CWE-502 yielding root) but with meaningful preconditions (local file load + user action), so it is a real priority for anyone running HunyuanVideo with untrusted model files, rather than a drop-everything internet-facing emergency. Note the AV:L vs. 'Remote' description tension - verify the exact delivery path with the ZDI advisory (ZDI-25-1030).

An attacker crafts a malicious VAE/model checkpoint containing a serialized (pickle) payload and distributes it via a model-sharing site, link, or file. When a victim loads that file through HunyuanVideo's load_vae function, the untrusted data is deserialized and attacker-controlled code executes in the context of root. No public exploit code is identified at time of analysis, but the deserialization pattern (CWE-502) is well understood and trivially weaponizable.